Skip to content
OpenAdvisories

Vendor

heyform

6 known vulnerabilities.

heyform at a glance

Last 12 months
6
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 4 vulnerabilities, 1 critical August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202600
Sep 202600
Aug 202610
Jul 202641
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

heyform 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.6
    CVE-2026-102615

    HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS

    HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy…

    heyform heyform
  • High 8.1
    CVE-2026-82291

    HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

    HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users …

    heyform heyform
  • High 8.6
    CVE-2026-63429

    HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

    HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload f…

    heyform heyform
  • Medium 5.8
    CVE-2026-63428

    HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

    HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` a…

    heyform heyform
  • Critical 9.0
    CVE-2026-35198

    HeyForm vulnerable to stored XSS via form field titles

    HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leadi…

    heyform heyform
  • Medium 6.4
    CVE-2026-45797

    HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

    HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by E…

    heyform heyform